There are certain applications of computing in which functions performed by the computer are sensitive and need to be protected from abuse and attack. For example, in a digital rights management (DRM) system that protects valuable (e.g., copyrighted) content from being used in an unlicensed manner, the content is typically stored in an encrypted form, and is decrypted only under the circumstances specified in an electronic license. Thus, the code that applies the decryption key to generate clear content is a sensitive piece of code, in the sense that such code should not divulge the decryption key, and should provide clear content only under circumstances that provide reasonable assurance that the clear content will not be misused or distributed in a manner that is contrary to license. The piece of code that performs the decryption function or any sensitive operations is, in some contexts, referred to as a “black box.” Such a black box should resist attempts by attackers to manipulate or misuse the black box binary or application which has the rights to the clear content in a manner that would divulge the key or the clear content.
A black box (or other program module that performs a sensitive function) should implement tamper-resistant measures that are designed to thwart known types of attack on the black box or the application which leverages its functionality. Typical tamper-resistance measures may include code obfuscation, code encryption, self-modification of code, and other known techniques that tend to confound analysis and manipulation of code.
While a computer program may employ tamper-resistant measures of the type described above, one security weakness not easily addressed by such techniques arises at the boundary between two code modules. Modem programs are typically modularized into components that communicate with each other by way of an interface. For example, the black box described above can be implemented as a dynamic-link library (DLL), which can be linked to, and called by, one or more application programs. The advantage to such a design is that the black box's function can be used (“consumed”) by many programs, without that function having to be implemented explicitly by each program, and without the inner workings of the black box having to be explicitly disclosed to the various third party vendors who may write the consuming programs. It also allows updates to the black box software to be made, for example to fix bugs or add additional tamper-resistance, without needing to recompile and reship all of the application programs which rely on its function. The disadvantage to such a design from a security standpoint, however, is that modularization generally facilitates and encourages the interoperation of code modules (e.g., in theory, any application can link to and call a DLL), while the security of the black box may depend on restricting the circumstances under which the black box can be called (e.g., the black box should not permit its decryption function to be called by applications that might disseminate valuable content in the clear).
Standard tamper-resistance techniques are focused on setting up a boundary around a code module and protecting that boundary from breach. However, since a DLL necessarily shares a permeable interface with its calling application, the standard tamper-resistance techniques do not address the need for protection in terms of how, and under what circumstances, this interface is used to permit access to the DLL's functionality.
In view of the foregoing, there is a need for a system that overcomes the drawbacks of the prior art.